KEV Exploitation Tabletop Kit

What this exercise practices

• confirming exposure to a known exploited vulnerability
• identifying owners and service dependencies
• deciding whether to patch now, delay, isolate, or apply compensating controls
• approving downtime or emergency changes
• briefing leadership in plain English
• capturing follow-up actions for process improvement

Threat context

This exercise includes a fictional threat profile — Spectral Raccoon / APT-1337 — to provide a consistent scenario context for participants. The profile is used to support discussion and decision-making during the exercise; it is not intended to represent real-world attribution.

• Provides a clear, memorable threat context for the scenario
• Supports discussion of urgency, patch timing, and leadership communications
• Keeps the exercise focused on decisions, coordination, and follow-through

Included materials

• Facilitator guide
• Participant brief
• Injects
• Evaluator worksheet
• Hotwash template
• Spectral Raccoon / APT-1337 threat snapshot
• Spectral Raccoon / APT-1337 intelligence brief

Recommended flow

1. Review the facilitator guide and threat brief.
2. Tailor the scenario to the real technology and services in your environment.
3. Distribute the threat snapshot to participants.
4. Run the injects and force clear decisions on downtime, patching, compensating controls, and communications.
5. Capture follow-up actions in the hotwash.